Learn · Guide · 5 min read

External vulnerability scan vs. penetration test

If you've been quoted thousands of dollars for a "penetration test," it's worth knowing exactly what you're buying, and whether regular scanning does the job for a fraction of the cost.

What an external vulnerability scan does

An automated external scan looks at your internet-facing systems the way an attacker's first pass would: whether your HTTPS certificate and supported TLS checks reveal issues, what your web server reveals, selected web configuration and email authentication signals, which ports answer, and which software versions those services report. A version with published vulnerabilities (CVEs) is flagged, but the scan never tries to exploit it. It's fast, repeatable, and affordable enough to run every day.

What a penetration test adds

A penetration test puts a skilled human in the loop. They take the weaknesses a scan finds and try to chain them together, use social engineering, and think creatively the way a real attacker would. It's deeper, produces a narrative of how far someone could get, and it's correspondingly expensive and occasional.

Which do you need?

For most small and mid-sized organizations, the honest answer is both, at different rhythms:

• Scan continuously (and after any change) to catch the common, high-impact issues quickly: an expired certificate, a port a vendor opened, a missing email record.
• Get a penetration test when it's genuinely called for, such as a compliance requirement, a major new system, or a customer's security questionnaire.

The mistake is treating a once-a-year assessment as your only line of sight. It's a photo when what you need is a heartbeat monitor: the day after the assessment, someone changes a firewall rule and you're blind again until next year.

Where Torva fits

Torva is the heartbeat: Edge scans your public systems daily or weekly, Core checks your internal network on your schedule, and both flag outdated software with known vulnerabilities, with plain-English fixes and a score you can track. Torva identifies what a scan can see; a penetration tester tries to use it. When you do commission a penetration test, you'll walk in with the easy findings already fixed, so the expert's time goes toward the deep work only a human can do.

---